A critical local privilege escalation vulnerability in Tonec Internet Download Manager, identified as CVE-2026-90493, allows a local attacker to achieve full system compromise.

The vulnerability resides in the idmwfp.sys kernel driver, which fails to implement correct access controls. This flaw allows a local, low-privileged attacker to perform unauthorized actions or gain elevated system privileges.

Successful exploitation of this vulnerability permits a local attacker to execute arbitrary code with kernel-level privileges. This results in complete system compromise, including the potential for data exfiltration, installation of persistent backdoors, and total loss of confidentiality, integrity, and availability. With a CVSS score of 8.8, this flaw represents a significant threat to internal security posture and system stability.

Immediate Action: Since no official patch is currently identified, users should restrict local access to affected workstations and monitor for any unauthorized execution of unfamiliar binaries.

Proactive Monitoring: Security teams should audit system logs for unexpected privilege escalation events or suspicious activity originating from the idmwfp.sys driver.

Compensating Controls: Implement strict application allowlisting to prevent the execution of untrusted local binaries or scripts that could leverage this kernel-mode vulnerability.

Public Exploit Available: Yes: A public proof-of-concept exists and is attributed to the research documentation hosted on GitHub.

Given the severity of the vulnerability and the availability of a public proof-of-concept, users are urged to treat this as a high-priority risk. Until Tonec releases a formal security update, administrators should limit local user permissions and monitor system integrity closely. Immediate application of vendor updates is required as soon as they become available to eliminate this vector for local privilege escalation.